+------------------------------+
| Host: |
| enp2s0 : 192.168.1.50/24 |
| wg0 : 172.31.0.6/24 |
| uservlan: 172.30.0.6/24 |
| +------------------------+ |
| | NS1: | |
| | eth0: 172.30.0.1/24 | |
| | | |
| +------------------------+ |
+------------------------------+
My host's routing table looks like this
# ip route
default via 192.168.1.254 dev enp2s0 proto dhcp src 192.168.1.50 metric 100
172.30.0.0/24 dev uservlan proto kernel scope link src 172.30.0.6
172.31.0.0/24 dev wg0 proto kernel scope link src 172.31.0.6
192.168.1.0/24 dev enp2s0 proto kernel scope link src 192.168.1.50 metric 100
192.168.1.254 dev enp2s0 proto dhcp scope link src 192.168.1.50 metric 100
What works
ping 172.30.0.1. # host to namespace
ip netns exec ns1 ping 8.8.8.8 # namespace to internet
ip netns exec ns1 ping 192.168.1.70 # namespace to lan computers
What doesn't work
ip netns exec ns1 ping 172.31.0.6 # ping on wg0 interface on host.
ip netns exec ns1 ping 172.31.0.7 # vpn peer
I tried logging all the relevant chains and it shows that the ping packets are going outside of host via enp2s0 instead of going to wg0
# dmesg --follow # while ping 172.31.0.6 from inside namepace
[523365.673316] [mangle-output]IN= OUT=enp2s0 SRC=172.30.0.1 DST=172.31.0.6 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=13443 DF PROTO=ICMP TYPE=8 CODE=0 ID=8340 SEQ=1
[523365.673319] [nat-output]IN= OUT=enp2s0 SRC=172.30.0.1 DST=172.31.0.6 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=13443 DF PROTO=ICMP TYPE=8 CODE=0 ID=8340 SEQ=1
[523365.673323] [filter-output]IN= OUT=enp2s0 SRC=172.30.0.1 DST=172.31.0.6 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=13443 DF PROTO=ICMP TYPE=8 CODE=0 ID=8340 SEQ=1
[523365.673326] [mangle-postrouting]IN=enp2s0 OUT=enp2s0 MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=172.30.0.1 DST=172.31.0.6 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=13443 DF PROTO=ICMP TYPE=8 CODE=0 ID=8340 SEQ=1
[523366.702921] [mangle-output]IN= OUT=enp2s0 SRC=172.30.0.1 DST=172.31.0.6 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=13511 DF PROTO=ICMP TYPE=8 CODE=0 ID=8340 SEQ=2
[523366.702924] [filter-output]IN= OUT=enp2s0 SRC=172.30.0.1 DST=172.31.0.6 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=13511 DF PROTO=ICMP TYPE=8 CODE=0 ID=8340 SEQ=2
[523366.702928] [mangle-postrouting]IN=enp2s0 OUT=enp2s0 MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=172.30.0.1 DST=172.31.0.6 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=13511 DF PROTO=ICMP TYPE=8 CODE=0 ID=8340 SEQ=2
[523367.726978] [mangle-output]IN= OUT=enp2s0 SRC=172.30.0.1 DST=172.31.0.6 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=13525 DF PROTO=ICMP TYPE=8 CODE=0 ID=8340 SEQ=3
[523367.726983] [filter-output]IN= OUT=enp2s0 SRC=172.30.0.1 DST=172.31.0.6 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=13525 DF PROTO=ICMP TYPE=8 CODE=0 ID=8340 SEQ=3
[523367.726987] [mangle-postrouting]IN=enp2s0 OUT=enp2s0 MAC=00:00:00:00:00:00:00:00:00:00:00:00:00:00 SRC=172.30.0.1 DST=172.31.0.6 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=13525 DF PROTO=ICMP TYPE=8 CODE=0 ID=8340 SEQ=3
[523368.754942] [mangle-output]IN= OUT=enp2s0 SRC=172.30.0.1 DST=172.31.0.6 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=13731 DF PROTO=ICMP TYPE=8 CODE=0 ID=8340 SEQ=4
[523368.754945] [filter-output]IN= OUT=enp2s0 SRC=172.30.0.1 DST=172.31.0.6 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=13731 DF PROTO=ICMP TYPE=8 CODE=0 ID=8340 SEQ=4
[523368.754949] [mangle-postrouting]IN=enp2s0 OUT=enp2s0 MAC=00:67:f8:68:a3:07:00:00:80:00:00:00:00:00 SRC=172.30.0.1 DST=172.31.0.6 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=13731 DF PROTO=ICMP TYPE=8 CODE=0 ID=8340 SEQ=4
I have enabled ip forwarding, and the packets are going inside the namespaces even from a vpn peer, but the reverse is not happening.
Routing tables is as expected. How do I change the output interface to wg0 using iptables?.
